MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 221b159a90aef53261b039b8b4b5e9256408265bc1227c32d0720a08cf237222. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 221b159a90aef53261b039b8b4b5e9256408265bc1227c32d0720a08cf237222
SHA3-384 hash: bb8ce92be0bfccc6f73ff657603536507c007e05b7537022d3f085973a4d327fac5bdcf4e2e2910904406ce9d70116f5
SHA1 hash: 1ae355ebecd9734484f94fea39abdee7162a9abd
MD5 hash: beac5f24f53c624fea20edf1cb0f3d65
humanhash: freddie-nitrogen-romeo-burger
File name:TT RECEIPT COPY.PNG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:468'299 bytes
First seen:2020-04-28 05:57:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:78O2+6ScBVfYRmIC5g3slCcUCHzOB9QLDIVm7d3RnX4:78O0XsmYUrHzOB9QLx/nX4
TLSH F3A4235CAB69B35BC16A8E6F3F4F1E274381E0C6B4F951B7E0274E84AB70984674079C
Reporter cocaman
Tags:AgentTesla PNG


Avatar
cocaman
Malicious email
From: Kostas Malioras<info@eurosteel.gr>
Received: from eurosteel.gr (unknown [5.79.121.91])
Date: 27 Apr 2020 16:42:39 -0700
Subject: Re: Transfer Confirmation
Attachment: TT RECEIPT COPY.PNG

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Loki
Create hunting rule
Status:
Malicious
First seen:
2020-04-28 06:35:41 UTC
File Type:
Binary (Archive)
Extracted files:
41
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=einrlguqv32teynqhg4ljnpjevsaqjs3yerhymwqoifartzdoira._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 221b159a90aef53261b039b8b4b5e9256408265bc1227c32d0720a08cf237222

(this sample)

AgentTesla

Executable exe 157e2d59ee91293baecbd5c998e21a5fd380bccf67bdc9168da44f5d20aada95

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 157e2d59ee91293baecbd5c998e21a5fd380bccf67bdc9168da44f5d20aada95

Comments